CVE-2022-47938: Linux ksmbd SMB2_TREE_CONNECT out-of-bounds read and OOPS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (6.5) with availability-only impact, but the high EPSS score and remote network reachability warrant prompt patching.

What it is

ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2 has an out-of-bounds read in fs/ksmbd/smb2misc.c when handling SMB2_TREE_CONNECT, leading to a kernel OOPS. The flaw is remotely reachable over the network by an authenticated SMB client and can crash the kernel, disrupting the SMB service and the host.

Impact

An attacker with valid SMB credentials can trigger an out-of-bounds read that causes a kernel OOPS, resulting in denial of service on the affected system. The CVSS vector indicates no confidentiality or integrity impact, only availability.

Attack surface

Reached over the network via SMB2 TREE_CONNECT requests to a ksmbd server; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low attack complexity, required low privileges (authenticated SMB session), and no user interaction.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high (0.60016, 99.09th percentile), and references include patch commits and a ZDI advisory but no public exploit tag.

What to do

• Upgrade the Linux kernel to 5.19.2 or later, which contains the fix commit 824d4f64c20093275f72fc8101394d75ff6a249e.
• If immediate patching is not possible, disable or stop the ksmbd service where SMB file sharing is not required.
• Restrict SMB access to trusted networks and accounts, since exploitation requires an authenticated session.
• Monitor kernel logs for OOPS or crash reports referencing fs/ksmbd/smb2misc.c and SMB2_TREE_CONNECT.

Detection

• Search kernel logs (dmesg, journalctl -k) for OOPS or BUG messages referencing ksmbd, smb2misc.c, or SMB2_TREE_CONNECT.
• Monitor for repeated or malformed SMB2 TREE_CONNECT requests against ksmbd hosts, especially from unusual clients.
• Track unexpected ksmbd service restarts or host reboots that coincide with SMB traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.